Overview of Security Enhancements for System.XML

  • Article

Several changes have taken place since the release of the .NET Framework version 1.0, and are found in this release of the .NET Framework version 1.1. This topic briefly outlines what classes are affected by the changes, and provides you with links to topics that contain detailed information.

XmlReader and its derived classes, XmlTextReader and XmlValidatingReader

Inheritance demand has been placed at the class level of the XmlTextReader and XmlValidatingReader. You must have full trust to inherit from either of these classes. For more information on inheritance demand, see Inheritance Demands and Security Demands. For more information on the changes to the XmlReader and its derived classes, see Reading XML with the XmlReader.

XmlDocument

The behavior of the Load method in the XmlDocument has been modified. It now depends on whether the class is fully trusted or semi-trusted. For more information on how the Load method is affected, see Resolving External Resources. In addition, inheritance demand at the method level has been placed on the XmlDocument methods, ReadNode and CreateDocumentType. For more information on inheritance demand, see Inheritance Demands and Security Demands.

XslTransform

The XslTransform class has acquired several behavioral differences. The following list outlines these behavior differences:

  • The XslTransform class can be used from semi-trusted code.

  • The XslTransform.Load method has a new Evidence parameter in the .NET Framework version 1.1. For more information, see XslTransform Class Implements the XSLT Processor.

  • The XslTransform.XmlResolver property is obsolete in .NET Framework version 1.1. Instead, use the new XslTransform.Transform overloads which are replaced by methods that are nearly identical, except for the addition of the XmlResolver argument. For more information, see XslTransform Class Implements the XSLT Processor.

  • The treatment of style sheets that reference external resources, and style sheets that run scripts, has changed. The XslTransform class supports embedded scripting using the msxsl:script element. In .NET Framework version 1.1, the evidence of the style sheet determines what permissions are given to embedded scripts.

    • If the style sheet was loaded from a URI, the URI is used to create the evidence. This evidence includes the URI along with its site and zone.
    • If the style sheet was loaded using another source, you can provide evidence by passing a System.Security.Policy.Evidence object to the Load method. Otherwise, the script assembly has full trust.

    For semi-trusted callers, UnmanagedCode permission is required to compile the embedded script. ControlEvidence permission is required to provide Evidence to the Load method. A SecurityException is thrown if the caller does not have the necessary permissions. See System.Security.Permissions.SecurityPermission and System.Security.Permissions.SecurityPermissionFlag for more information.

    For more information, see Resolving External XSLT Stylesheets and Documents

XmlResolver

Inheritance demand for full trust has been placed at the method ResolveUri in the XmlResolver class. For more information on inheritance demand, see Inheritance Demands and Security Demands.

A new derived class, XmlSecureResolver, has been added to the .NET Framework version 1.1. This class allows fully trusted applications to provide evidence when accessing data and external resources. For more information, see Resolve External XML Resources Named by a URI.

See Also

Architectural Overview of XML in the .NET Framework | XML Document Object Model (DOM) | Reading XML with the XmlReader | Writing XML with the XmlWriter | XSLT Transformations with the XslTransform Class | XPathNavigator in the .NET Framework | XML Schema Object Model (SOM) | Validation of XML with Schemas | XML Integration with Relational Data and ADO.NET | Resolve External XML Resources Named by a URI | Character Encoding of XML Names and Conversion of XML Data Types | Conversion of XML Data Types | Namespaces in an XML Document